topic Re: How to measure bandwidth on CP Gateway? in Firewall and Security Management

How to measure bandwidth on CP Gateway?

Vladimir_S — Mon, 26 Dec 2022 06:46:24 GMT

Hello,

Bandwidth on a device in front of external interface is 950 Mbps (I connected a laptop to the ISP's provider's router directly), bandwidth behind of internal interface is 95 Mbps (I disconnected entire LAN from the gateway and connected a laptop only). Apparently there an issue with CP.

Is there a way to measure bandwidth on the Gateway? I'm running Gaia on Open Server R81.

Thank you,

Vlad.

Re: How to measure bandwidth on CP Gateway?

Chris_Atkinson — Mon, 26 Dec 2022 07:43:09 GMT

cpview will report throughput... we don't support installing speedtest tools on the gateway itself but you have utilities such as curl available.

What blades are enabled and did the test involve multiple concurrent threads/connections?

How is the interface speed/duplex configured and is the server hardware listed on our HCL?

There are likely many other relevant questions...

Re: How to measure bandwidth on CP Gateway?

Blason_R — Mon, 26 Dec 2022 09:12:40 GMT

Can not exactly say there is a issue with CP. When you disconnect lan and attach only laptop obviously only laptop is sending a traffic. While with LAN other hosts are pumping the traffic. TO confirm use cpview and under CPU -> Top Connections see who is transferring the data.

Plus if you feel hosts are sending a data and no getting proper bw; capture the packet using tcpdump on your internal interface or external inteface for a min or so and then analyze it with cpmonitor.

Re: How to measure bandwidth on CP Gateway?

PhoneBoy — Mon, 26 Dec 2022 14:42:45 GMT

What is your precise method for testing speed?
What precise observations did you make on the gateways while attempting this speed test?
Super Seven output while the device is under test will help: https://community.checkpoint.com/t5/Scripts/S7PAC-Super-Seven-Performance-Assessment-Commands/m-p/40528

In any case, a single flow from a single system may not achieve full bandwidth you have available or the capacity of the appliance.
It is not necessarily indicative of a problem.

Re: How to measure bandwidth on CP Gateway?

Timothy_Hall — Mon, 26 Dec 2022 15:27:50 GMT

You can install iperf3 on the firewall's Gaia OS directly, see here: Test bandwidth/speed from Gaia

However all this will measure is performance between the firewall itself and an iperf3 server, but not the actual throughput for traffic being fully inspected while crossing/transiting the firewall. However this tool can be useful for finding network errors/bottlenecks outside the firewall itself.

Re: How to measure bandwidth on CP Gateway?

Vladimir_S — Tue, 27 Dec 2022 17:34:58 GMT

Hi Chris,

I attached three screenshots with: throughput, enabled blades and external interface configuration. Full duplex is enabled on both interfaces.
Yes, I tested involving multiple threads/connections and single host as well. The bandwith is the same in both tests.
There is one more detail. When ISP replaced their router and increased bandwidth it did not affect the LAN. LAN bandwidth is remaining 95 Mbps, WAN bandwidth increased up to 950 Mbps.

Vlad.

Re: How to measure bandwidth on CP Gateway?

PhoneBoy — Tue, 27 Dec 2022 18:30:44 GMT

To even begin to determine definitely what is happening here, please answer the following questions:

Output of the Super Seven commands I linked earlier in the thread while the device is under test
The precise method you are using from your laptop to test bandwidth

My speculation, based on the very limited information you have provided this far, is you’re using a method that invokes a single heavy TCP stream.
This is called an elephant flow and is not in any way indicative of the overall bandwidth available for other traffic flowing through the gateway.

Note that we’ve made some improvements to handing elephant flows in R81.20 with HyperFlow.
However, it’s only supported on Check Point appliances, currently.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk178070&partition=Advanced&product=Quantum

Re: How to measure bandwidth on CP Gateway?

Chris_Atkinson — Wed, 28 Dec 2022 15:00:46 GMT

What license is applied to this machine, is corexl enabled for multiple cores?

Refer also:

sk98871: HTTP-based speed test shows strong degradation in download speed when Anti-Virus is set to inspect all HTTP and HTTPS traffic

Re: How to measure bandwidth on CP Gateway?

the_rock — Wed, 28 Dec 2022 00:05:09 GMT

Im so glad you posted this, because in all my years dealing with CP, I could NEVER find a logical way to do this. I cant even count how many TAC cases I opened asking this question...I stopped counting after 15 probably (lol). Yes, its gotten better in R80+, but I still have customers asking me for something simple/easy.

Re: How to measure bandwidth on CP Gateway?

Vladimir_S — Wed, 28 Dec 2022 05:34:31 GMT

Hi Blason,I attached cpview screenshots with two instances, Instance0 and Instance1. I'll check tcpdump later.

Thank you,

Vlad.

Re: How to measure bandwidth on CP Gateway?

Vladimir_S — Wed, 28 Dec 2022 06:20:39 GMT

Hi PhoneBoy,

I ran speed test on couple random websites.

https://www.speedtest.net/

https://www.att.com/support/speedtest/

The gateway in production. I do not have a test gateway.

I noticed the bandwidth issue started when our ISP replaced the router and increased the bandwidth. So, the bandwidth in front of CP increased accordingly provider's service, but behind of CP was not changed.

Thank you,

Vlad.

Re: How to measure bandwidth on CP Gateway?

Blason_R — Wed, 28 Dec 2022 06:25:19 GMT

Ok - Are you noticing RX_DROPs on that interface? and are those getting increased rapidly? Please provide output netstat -ni 2

and ethtool -S <interface_name>

then ethttool -g <interface_name>

Re: How to measure bandwidth on CP Gateway?

Vladimir_S — Wed, 28 Dec 2022 06:50:39 GMT

Hi Timothy,

My next step to set iperf3 server on the WAN side, client on the LAN and run bandwidth test.

Thank you,

Vlad.

Re: How to measure bandwidth on CP Gateway?

PhoneBoy — Wed, 28 Dec 2022 14:30:46 GMT

I believe most of these speed test websites use a single TCP connection.
Which, as I noted before, is potentially problematic and won’t give you an accurate result of available bandwidth.
The output of the Super Seven commands are needed to confirm what is actually happening.

Re: How to measure bandwidth on CP Gateway?

Vladimir_S — Thu, 29 Dec 2022 06:35:40 GMT

Chris, how to check if CoreXL is activated? I think we have only two core license. I read sk98871 and can try to stop Anti-Virus blade.

Also, I asked our account manager for a trial SecureXL license.

Re: How to measure bandwidth on CP Gateway?

Vladimir_S — Thu, 29 Dec 2022 07:38:01 GMT

Outputs of netstat -ni 2, ethtool -S and ethtool -g are attached.

Re: How to measure bandwidth on CP Gateway?

Chris_Atkinson — Thu, 29 Dec 2022 11:15:29 GMT

Suggest providing the info requested prior from @PhoneBoy regarding the S7 commands otherwise the following outputs from the gateway would be helpful short of the above.

fw ctl multik stat

cplic print

To manage/enable corexl (license permitting):

cpconfig > option 7

Re: How to measure bandwidth on CP Gateway?

Blason_R — Thu, 29 Dec 2022 08:27:36 GMT

Oh you ran the wrong netstat command. It should be netstat -ni 2 and not netstat ni 2. It looks like Buffer size is not set to max provided you are noticing too much rx-DRP

Re: How to measure bandwidth on CP Gateway?

PhoneBoy — Thu, 29 Dec 2022 14:37:22 GMT

You can generate your own eval license per the instructions here: https://community.checkpoint.com/t5/General-Topics/How-to-Request-an-Evaluation-License-for-Security-Gateways-and/m-p/40391#M8499
The "All-in-One" eval should give you a license for 8 cores.

If you only have a two core license, that will limit your performance substantially since only two cores will be used.

Re: How to measure bandwidth on CP Gateway?

Vladimir_S — Sun, 01 Jan 2023 23:35:54 GMT

netstat -ni 2 attached.